From ae9c9ef5a5ba06cf57b5a87b5f2bbc71649ba41b Mon Sep 17 00:00:00 2001

From: Evan Hunt <each@isc.org>

Date: Tue, 12 Sep 2017 19:05:46 -0700

Subject: [PATCH] rebased rt31459c

[rt31459d] update the newer tools

[rt31459d] setup entropy in dns_lib_init()

[rt31459d] silence compiler warning

DNS_OPENSSL_LIBS -> DST_OPENSSL_LIBS

Include new unit test

---

 bin/confgen/keygen.c                     |   7 +

 bin/dnssec/dnssec-dsfromkey.c            |   8 +-

 bin/dnssec/dnssec-importkey.c            |   8 +-

 bin/dnssec/dnssec-revoke.c               |   8 +-

 bin/dnssec/dnssec-settime.c              |   8 +-

 bin/dnssec/dnssec-signzone.c             |  11 +-

 bin/dnssec/dnssec-verify.c               |   8 +-

 bin/dnssec/dnssectool.c                  |  11 +-

 bin/named/server.c                       |   6 +

 bin/nsupdate/nsupdate.c                  |  18 ++-

 bin/tests/makejournal.c                  |   6 +-

 bin/tests/system/pipelined/pipequeries.c |  20 ++-

 bin/tests/system/pipelined/tests.sh      |   4 +-

 bin/tests/system/rsabigexponent/bigkey.c |   4 +

 bin/tests/system/tkey/keycreate.c        |  26 +++-

 bin/tests/system/tkey/keydelete.c        |  26 +++-

 bin/tests/system/tkey/tests.sh           |   8 +-

 bin/tools/mdig.c                         |   3 +-

 configure                                | 250 ++++++++++++++++++-------------

 configure.in                             |  77 +++++++++-

 lib/dns/dst_api.c                        |  21 ++-

 lib/dns/include/dst/dst.h                |   8 +

 lib/dns/lib.c                            |  17 ++-

 lib/dns/openssl_link.c                   |  72 ++++++++-

 lib/dns/pkcs11.c                         |  29 +++-

 lib/dns/tests/Atffile                    |   1 +

 lib/dns/tests/Kyuafile                   |   1 +

 lib/dns/tests/Makefile.in                |   7 +

 lib/dns/tests/dnstest.c                  |  14 +-

 lib/dns/tests/dstrandom_test.c           | 105 +++++++++++++

 lib/dns/win32/libdns.def.in              |   7 +

 lib/isc/entropy.c                        |  24 +++

 lib/isc/include/isc/entropy.h            |  12 ++

 lib/isc/include/isc/platform.h.in        |   5 +

 lib/isc/include/isc/types.h              |   2 +

 lib/isc/pk11.c                           |  12 +-

 lib/isc/win32/include/isc/platform.h.in  |   5 +

 win32utils/Configure                     |  29 +++-

 38 files changed, 704 insertions(+), 184 deletions(-)

 create mode 100644 lib/dns/tests/dstrandom_test.c

diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c

index 11cc54d..fa439cc 100644

--- a/bin/confgen/keygen.c

+++ b/bin/confgen/keygen.c

@@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,

 		randomfile = NULL;

 		open_keyboard = ISC_ENTROPY_KEYBOARDYES;

 	}

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	if (randomfile != NULL &&

+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {

+		randomfile = NULL;

+		isc_entropy_usehook(ectx, ISC_TRUE);

+	}

+#endif

 	DO("start entropy source", isc_entropy_usebestsource(ectx,

 							     &entropy_source,

 							     randomfile,

diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c

index 94a982c..897c497 100644

--- a/bin/dnssec/dnssec-dsfromkey.c

+++ b/bin/dnssec/dnssec-dsfromkey.c

@@ -495,14 +495,14 @@ main(int argc, char **argv) {

 	if (ectx == NULL)

 		setup_entropy(mctx, NULL, &ectx);

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

-	if (result != ISC_R_SUCCESS)

-		fatal("could not initialize hash");

 	result = dst_lib_init(mctx, ectx,

 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);

 	if (result != ISC_R_SUCCESS)

 		fatal("could not initialize dst: %s",

 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("could not initialize hash");

 	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log;;

@@ -564,8 +564,8 @@ main(int argc, char **argv) {

 	if (dns_rdataset_isassociated(&rdataset))

 		dns_rdataset_disassociate(&rdataset);

 	cleanup_logging(&log;;

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	cleanup_entropy(&ectx);

 	dns_name_destroy();

 	if (verbose > 10)

diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c

index 2edf614..840316c 100644

--- a/bin/dnssec/dnssec-importkey.c

+++ b/bin/dnssec/dnssec-importkey.c

@@ -406,14 +406,14 @@ main(int argc, char **argv) {

 	if (ectx == NULL)

 		setup_entropy(mctx, NULL, &ectx);

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

-	if (result != ISC_R_SUCCESS)

-		fatal("could not initialize hash");

 	result = dst_lib_init(mctx, ectx,

 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);

 	if (result != ISC_R_SUCCESS)

 		fatal("could not initialize dst: %s",

 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("could not initialize hash");

 	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log;;

@@ -457,8 +457,8 @@ main(int argc, char **argv) {

 	if (dns_rdataset_isassociated(&rdataset))

 		dns_rdataset_disassociate(&rdataset);

 	cleanup_logging(&log;;

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	cleanup_entropy(&ectx);

 	dns_name_destroy();

 	if (verbose > 10)

diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c

index 10fad0b..0b68e99 100644

--- a/bin/dnssec/dnssec-revoke.c

+++ b/bin/dnssec/dnssec-revoke.c

@@ -182,14 +182,14 @@ main(int argc, char **argv) {

 	if (ectx == NULL)

 		setup_entropy(mctx, NULL, &ectx);

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

-	if (result != ISC_R_SUCCESS)

-		fatal("Could not initialize hash");

 	result = dst_lib_init2(mctx, ectx, engine,

 			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);

 	if (result != ISC_R_SUCCESS)

 		fatal("Could not initialize dst: %s",

 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("Could not initialize hash");

 	isc_entropy_stopcallbacksources(ectx);

 	result = dst_key_fromnamedfile(filename, dir,

@@ -271,8 +271,8 @@ main(int argc, char **argv) {

 cleanup:

 	dst_key_free(&key);

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	cleanup_entropy(&ectx);

 	if (verbose > 10)

 		isc_mem_stats(mctx, stdout);

diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c

index 360cdb9..b7bf171 100644

--- a/bin/dnssec/dnssec-settime.c

+++ b/bin/dnssec/dnssec-settime.c

@@ -380,14 +380,14 @@ main(int argc, char **argv) {

 	if (ectx == NULL)

 		setup_entropy(mctx, NULL, &ectx);

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

-	if (result != ISC_R_SUCCESS)

-		fatal("Could not initialize hash");

 	result = dst_lib_init2(mctx, ectx, engine,

 			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);

 	if (result != ISC_R_SUCCESS)

 		fatal("Could not initialize dst: %s",

 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("Could not initialize hash");

 	isc_entropy_stopcallbacksources(ectx);

 	if (predecessor != NULL) {

@@ -672,8 +672,8 @@ main(int argc, char **argv) {

 	if (prevkey != NULL)

 		dst_key_free(&prevkey);

 	dst_key_free(&key);

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	cleanup_entropy(&ectx);

 	if (verbose > 10)

 		isc_mem_stats(mctx, stdout);

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c

index 1bea357..53be1f5 100644

--- a/bin/dnssec/dnssec-signzone.c

+++ b/bin/dnssec/dnssec-signzone.c

@@ -3459,14 +3459,15 @@ main(int argc, char *argv[]) {

 	if (!pseudorandom)

 		eflags |= ISC_ENTROPY_GOODONLY;

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

-	if (result != ISC_R_SUCCESS)

-		fatal("could not create hash context");

-

 	result = dst_lib_init2(mctx, ectx, engine, eflags);

 	if (result != ISC_R_SUCCESS)

 		fatal("could not initialize dst: %s",

 		      isc_result_totext(result));

+

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("could not create hash context");

+

 	isc_stdtime_get(&now;;

 	if (startstr != NULL) {

@@ -3878,8 +3879,8 @@ main(int argc, char *argv[]) {

 	dns_master_styledestroy(&dsstyle, mctx);

 	cleanup_logging(&log;;

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	cleanup_entropy(&ectx);

 	dns_name_destroy();

 	if (verbose > 10)

diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c

index 792510a..dc32765 100644

--- a/bin/dnssec/dnssec-verify.c

+++ b/bin/dnssec/dnssec-verify.c

@@ -280,15 +280,15 @@ main(int argc, char *argv[]) {

 	if (ectx == NULL)

 		setup_entropy(mctx, NULL, &ectx);

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

-	if (result != ISC_R_SUCCESS)

-		fatal("could not create hash context");

-

 	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);

 	if (result != ISC_R_SUCCESS)

 		fatal("could not initialize dst: %s",

 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);

+	if (result != ISC_R_SUCCESS)

+		fatal("could not create hash context");

+

 	isc_stdtime_get(&now;;

 	rdclass = strtoclass(classname);

diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c

index dc32c90..4ea9eaf 100644

--- a/bin/dnssec/dnssectool.c

+++ b/bin/dnssec/dnssectool.c

@@ -32,6 +32,7 @@

 #include <isc/heap.h>

 #include <isc/list.h>

 #include <isc/mem.h>

+#include <isc/platform.h>

 #include <isc/print.h>

 #include <isc/string.h>

 #include <isc/time.h>

@@ -233,7 +234,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {

 	if (*ectx == NULL) {

 		result = isc_entropy_create(mctx, ectx);

 		if (result != ISC_R_SUCCESS)

-			fatal("could not create entropy object");

+			fatal("could not create entropy object: %s",

+			      isc_result_totext(result));

 		ISC_LIST_INIT(sources);

 	}

@@ -242,6 +244,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {

 		randomfile = NULL;

 	}

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	if (randomfile != NULL &&

+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {

+		randomfile = NULL;

+		isc_entropy_usehook(*ectx, ISC_TRUE);

+	}

+#endif

 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,

 					   usekeyboard);

diff --git a/bin/named/server.c b/bin/named/server.c

index 59a8998..ee5186c 100644

--- a/bin/named/server.c

+++ b/bin/named/server.c

@@ -34,6 +34,7 @@

 #include <isc/lex.h>

 #include <isc/meminfo.h>

 #include <isc/parseint.h>

+#include <isc/platform.h>

 #include <isc/portset.h>

 #include <isc/print.h>

 #include <isc/random.h>

@@ -8083,6 +8084,10 @@ load_configuration(const char *filename, ns_server_t *server,

 				      "no source of entropy found");

 		} else {

 			const char *randomdev = cfg_obj_asstring(obj);

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)

+				isc_entropy_usehook(ns_g_entropy, ISC_TRUE);

+#else

 			int level = ISC_LOG_ERROR;

 			result = isc_entropy_createfilesource(ns_g_entropy,

 							      randomdev);

@@ -8117,6 +8122,7 @@ load_configuration(const char *filename, ns_server_t *server,

 				}

 				isc_entropy_detach(&ns_g_fallbackentropy);

 			}

+#endif

 #endif

 		}

 	}

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c

index bb5d500..46c7acf 100644

--- a/bin/nsupdate/nsupdate.c

+++ b/bin/nsupdate/nsupdate.c

@@ -33,6 +33,7 @@

 #include <isc/mem.h>

 #include <isc/parseint.h>

 #include <isc/print.h>

+#include <isc/platform.h>

 #include <isc/random.h>

 #include <isc/region.h>

 #include <isc/sockaddr.h>

@@ -269,7 +270,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {

 	if (*ectx == NULL) {

 		result = isc_entropy_create(mctx, ectx);

 		if (result != ISC_R_SUCCESS)

-			fatal("could not create entropy object");

+			fatal("could not create entropy object: %s",

+			      isc_result_totext(result));

 		ISC_LIST_INIT(sources);

 	}

@@ -278,6 +280,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {

 		randomfile = NULL;

 	}

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	if (randomfile != NULL &&

+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {

+		randomfile = NULL;

+		isc_entropy_usehook(*ectx, ISC_TRUE);

+	}

+#endif

 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,

 					   usekeyboard);

@@ -948,11 +957,11 @@ setup_system(void) {

 		}

 	}

-	setup_entropy(gmctx, NULL, &entropy);

+	if (entropy == NULL)

+		setup_entropy(gmctx, NULL, &entropy);

 	result = isc_hash_create(gmctx, entropy, DNS_NAME_MAXWIRE);

 	check_result(result, "isc_hash_create");

-	isc_hash_init();

 	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);

 	check_result(result, "dns_dispatchmgr_create");

@@ -976,6 +985,9 @@ setup_system(void) {

 	check_result(result, "dst_lib_init");

 	is_dst_up = ISC_TRUE;

+	/* moved after dst_lib_init() */

+	isc_hash_init();

+

 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;

 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;

diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c

index fed59be..9f125da 100644

--- a/bin/tests/makejournal.c

+++ b/bin/tests/makejournal.c

@@ -100,12 +100,12 @@ main(int argc, char **argv) {

 	CHECK(isc_mem_create(0, 0, &mctx));

 	CHECK(isc_entropy_create(mctx, &ectx));

-	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

-	hash_active = ISC_TRUE;

-

 	CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));

 	dst_active = ISC_TRUE;

+	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

+	hash_active = ISC_TRUE;

+

 	CHECK(isc_log_create(mctx, &lctx, &logconfig));

 	isc_log_registercategories(lctx, categories);

 	isc_log_setcontext(lctx);

diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c

index 379b6a3..810d99e 100644

--- a/bin/tests/system/pipelined/pipequeries.c

+++ b/bin/tests/system/pipelined/pipequeries.c

@@ -202,6 +202,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {

 int

 main(int argc, char *argv[]) {

+	char *randomfile = NULL;

 	isc_sockaddr_t bind_any;

 	struct in_addr inaddr;

 	isc_result_t result;

@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {

 	UNUSED(argv);

 	isc_commandline_errprint = ISC_FALSE;

-	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {

+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {

 		switch (c) {

 		case 'p':

 			result = isc_parse_uint16(&port,

@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {

 				exit(1);

 			}

 			break;

+		case 'r':

+			randomfile = isc_commandline_argument;

+			break;

 		case '?':

 			fprintf(stderr, "%s: invalid argument '%c'",

 				argv[0], c);

@@ -274,10 +278,18 @@ main(int argc, char *argv[]) {

 	ectx = NULL;

 	RUNCHECK(isc_entropy_create(mctx, &ectx));

-	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));

-	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	if (randomfile != NULL &&

+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {

+		randomfile = NULL;

+		isc_entropy_usehook(ectx, ISC_TRUE);

+	}

+#endif

+	if (randomfile != NULL)

+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));

 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));

+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

 	taskmgr = NULL;

 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));

@@ -330,8 +342,8 @@ main(int argc, char *argv[]) {

 	isc_task_detach(&task);

 	isc_taskmgr_destroy(&taskmgr);

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	isc_entropy_detach(&ectx);

 	isc_log_destroy(&lctx);

diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh

index a6720ce..9063b1f 100644

--- a/bin/tests/system/pipelined/tests.sh

+++ b/bin/tests/system/pipelined/tests.sh

@@ -19,7 +19,7 @@ status=0

 echo_i "check pipelined TCP queries"

 ret=0

-$PIPEQUERIES -p ${PORT} < input > raw || ret=1

+$PIPEQUERIES -p ${PORT} -r $RANDFILE < input > raw || ret=1

 awk '{ print $1 " " $5 }' < raw > output

 sort < output > output-sorted

 diff ref output-sorted || { ret=1 ; echo_i "diff sorted failed"; }

@@ -43,7 +43,7 @@ status=`expr $status + $ret`

 echo_i "check keep-response-order"

 ret=0

-$PIPEQUERIES -p ${PORT} ++ < inputb > rawb || ret=1

+$PIPEQUERIES -p ${PORT} -r $RANDFILE ++ < inputb > rawb || ret=1

 awk '{ print $1 " " $5 }' < rawb > outputb

 diff refb outputb || ret=1

 if [ $ret != 0 ]; then echo_i "failed"; fi

diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c

index 4462f2e..f1230d8 100644

--- a/bin/tests/system/rsabigexponent/bigkey.c

+++ b/bin/tests/system/rsabigexponent/bigkey.c

@@ -20,6 +20,7 @@

 #include <isc/buffer.h>

 #include <isc/entropy.h>

 #include <isc/mem.h>

+#include <isc/platform.h>

 #include <isc/print.h>

 #include <isc/region.h>

 #include <isc/stdio.h>

@@ -183,6 +184,9 @@ main(int argc, char **argv) {

 	CHECK(isc_mem_create(0, 0, &mctx), "isc_mem_create()");

 	CHECK(isc_entropy_create(mctx, &ectx), "isc_entropy_create()");

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	isc_entropy_usehook(ectx, ISC_TRUE);

+#endif

 	CHECK(isc_entropy_usebestsource(ectx, &source,

 					"../random.data",

 					ISC_ENTROPY_KEYBOARDNO),

diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c

index 489f439..4f2f5b4 100644

--- a/bin/tests/system/tkey/keycreate.c

+++ b/bin/tests/system/tkey/keycreate.c

@@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {

 int

 main(int argc, char *argv[]) {

 	char *ourkeyname;

+	char *randomfile;

 	isc_taskmgr_t *taskmgr;

 	isc_timermgr_t *timermgr;

 	isc_socketmgr_t *socketmgr;

@@ -225,10 +226,21 @@ main(int argc, char *argv[]) {

 	RUNCHECK(isc_app_start());

+	randomfile = NULL;

+

 	if (argc < 2) {

 		fprintf(stderr, "I:no DH key provided\n");

 		exit(-1);

 	}

+	if (strcmp(argv[1], "-r") == 0) {

+		if (argc < 4) {

+			fprintf(stderr, "I:no DH key provided\n");

+			exit(-1);

+		}

+		randomfile = argv[2];

+		argv += 2;

+		argc -= 2;

+	}

 	ourkeyname = argv[1];

 	if (argc >= 3)

@@ -242,14 +254,22 @@ main(int argc, char *argv[]) {

 	ectx = NULL;

 	RUNCHECK(isc_entropy_create(mctx, &ectx));

-	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));

-	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	if (randomfile != NULL &&

+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {

+		randomfile = NULL;

+		isc_entropy_usehook(ectx, ISC_TRUE);

+	}

+#endif

+	if (randomfile != NULL)

+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));

 	log = NULL;

 	logconfig = NULL;

 	RUNCHECK(isc_log_create(mctx, &log, &logconfig));

 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));

+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

 	taskmgr = NULL;

 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));

@@ -328,8 +348,8 @@ main(int argc, char *argv[]) {

 	isc_log_destroy(&log;;

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	isc_entropy_detach(&ectx);

 	isc_mem_destroy(&mctx);

diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c

index 36ee6c7..0975bbe 100644

--- a/bin/tests/system/tkey/keydelete.c

+++ b/bin/tests/system/tkey/keydelete.c

@@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {

 int

 main(int argc, char **argv) {

 	char *keyname;

+	char *randomfile;

 	isc_taskmgr_t *taskmgr;

 	isc_timermgr_t *timermgr;

 	isc_socketmgr_t *socketmgr;

@@ -156,10 +157,21 @@ main(int argc, char **argv) {

 	RUNCHECK(isc_app_start());

+	randomfile = NULL;

+

 	if (argc < 2) {

 		fprintf(stderr, "I:no key to delete\n");

 		exit(-1);

 	}

+	if (strcmp(argv[1], "-r") == 0) {

+		if (argc < 4) {

+			fprintf(stderr, "I:no DH key provided\n");

+			exit(-1);

+		}

+		randomfile = argv[2];

+		argv += 2;

+		argc -= 2;

+	}

 	keyname = argv[1];

 	dns_result_register();

@@ -169,14 +181,22 @@ main(int argc, char **argv) {

 	ectx = NULL;

 	RUNCHECK(isc_entropy_create(mctx, &ectx));

-	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));

-	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

+#ifdef ISC_PLATFORM_CRYPTORANDOM

+	if (randomfile != NULL &&

+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {

+		randomfile = NULL;

+		isc_entropy_usehook(ectx, ISC_TRUE);

+	}

+#endif

+	if (randomfile != NULL)

+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));

 	log = NULL;

 	logconfig = NULL;

 	RUNCHECK(isc_log_create(mctx, &log, &logconfig));

 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));

+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

 	taskmgr = NULL;

 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));

@@ -265,8 +285,8 @@ main(int argc, char **argv) {

 	isc_log_destroy(&log;;

-	dst_lib_destroy();

 	isc_hash_destroy();

+	dst_lib_destroy();

 	isc_entropy_detach(&ectx);

 	isc_mem_destroy(&mctx);

diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh

index 9f90dd7..fad6c83 100644

--- a/bin/tests/system/tkey/tests.sh

+++ b/bin/tests/system/tkey/tests.sh

@@ -33,7 +33,7 @@ for owner in . foo.example.

 do

 	echo "I:creating new key using owner name \"$owner\""

 	ret=0

-	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1

+	keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` || ret=1

 	if [ $ret != 0 ]; then

 		echo "I:failed"

 		status=`expr $status + $ret`

@@ -55,7 +55,7 @@ do

 	echo "I:deleting new key"

 	ret=0

-	$KEYDELETE $keyname || ret=1

+	$KEYDELETE -r $RANDFILE $keyname || ret=1

 	if [ $ret != 0 ]; then

 		echo "I:failed"

 	fi

@@ -75,7 +75,7 @@ done

 echo "I:creating new key using owner name bar.example."

 ret=0

-keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1

+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1

 if [ $ret != 0 ]; then

         echo "I:failed"

 	status=`expr $status + $ret`

@@ -116,7 +116,7 @@ status=`expr $status + $ret`

 echo "I:recreating the bar.example. key"

 ret=0

-keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1

+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1

 if [ $ret != 0 ]; then

         echo "I:failed"

 	status=`expr $status + $ret`

diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c

index 1f5dd4c..4e3bfa5 100644

--- a/bin/tools/mdig.c

+++ b/bin/tools/mdig.c

@@ -1933,12 +1933,11 @@ main(int argc, char *argv[]) {

 	ectx = NULL;

 	RUNCHECK(isc_entropy_create(mctx, &ectx));

+	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));

 	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));

 	RUNCHECK(isc_entropy_getdata(ectx, cookie_secret,

 				     sizeof(cookie_secret), NULL, 0));

-	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));

-

 	ISC_LIST_INIT(queries);

 	parse_args(ISC_FALSE, argc, argv);

 	if (server == NULL)

diff --git a/configure b/configure

index c83773a..ac1ea3f 100755

--- a/configure

+++ b/configure

@@ -640,6 +640,7 @@ ac_includes_default="\

 ac_subst_vars='LTLIBOBJS

 LIBOBJS

+LIBDIR_SUFFIX

 BUILD_LIBS

 BUILD_LDFLAGS

 BUILD_CPPFLAGS

@@ -825,6 +826,7 @@ XMLSTATS

 NZDTARGETS

 NZDSRCS

 NZD_TOOLS

+ISC_PLATFORM_CRYPTORANDOM

 PKCS11_TEST

 PKCS11_ED25519

 PKCS11_GOST

@@ -1037,6 +1039,7 @@ with_eddsa

 with_aes

 enable_openssl_hash

 with_cc_alg

+enable_crypto_rand

 with_lmdb

 with_libxml2

 with_libjson

@@ -1730,6 +1733,7 @@ Optional Features:

   --enable-threads        enable multithreading

   --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]

   --enable-openssl-hash   use OpenSSL for hash functions [default=no]

+  --enable-crypto-rand    use the crypto provider for random [default=yes]

   --enable-largefile      64-bit file support

   --enable-backtrace      log stack backtrace on abort [default=yes]

   --enable-symtable       use internal symbol table for backtrace

@@ -16486,6 +16490,7 @@ case "$use_openssl" in

 $as_echo "disabled because of native PKCS11" >&6; }

 		DST_OPENSSL_INC=""

 		CRYPTO="-DPKCS11CRYPTO"

+		CRYPTOLIB="pkcs11"

 		OPENSSLECDSALINKOBJS=""

 		OPENSSLECDSALINKSRCS=""

 		OPENSSLEDDSALINKOBJS=""

@@ -16500,6 +16505,7 @@ $as_echo "disabled because of native PKCS11" >&6; }

 $as_echo "no" >&6; }

 		DST_OPENSSL_INC=""

 		CRYPTO=""

+		CRYPTOLIB=""

 		OPENSSLECDSALINKOBJS=""

 		OPENSSLECDSALINKSRCS=""

 		OPENSSLEDDSALINKOBJS=""

@@ -16512,6 +16518,7 @@ $as_echo "no" >&6; }

 	auto)

 		DST_OPENSSL_INC=""

 		CRYPTO=""

+		CRYPTOLIB=""

 		OPENSSLECDSALINKOBJS=""

 		OPENSSLECDSALINKSRCS=""

 		OPENSSLEDDSALINKOBJS=""

@@ -16521,7 +16528,7 @@ $as_echo "no" >&6; }

 		OPENSSLLINKOBJS=""

 		OPENSSLLINKSRCS=""

 		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path

-If you don't want OpenSSL, use --without-openssl" "$LINENO" 5

+If you do not want OpenSSL, use --without-openssl" "$LINENO" 5

 		;;

 	*)

 		if test "yes" = "$want_native_pkcs11"

@@ -16552,6 +16559,7 @@ $as_echo "not found" >&6; }

 			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5

 		fi

 		CRYPTO='-DOPENSSL'

+		CRYPTOLIB="openssl"

 		if test "/usr" = "$use_openssl"

 		then

 			DST_OPENSSL_INC=""

@@ -17213,8 +17221,6 @@ fi

 # Use OpenSSL for hash functions

 #

-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using OpenSSL for hash functions" >&5

-$as_echo_n "checking for using OpenSSL for hash functions... " >&6; }

 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"

 case $want_openssl_hash in

 	yes)

@@ -17583,6 +17589,86 @@ if test "rt" = "$have_clock_gt"; then

 	LIBS="-lrt $LIBS"

 fi

+#

+# Use the crypto provider (OpenSSL/PKCS#11) for random functions

+#

+

+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using the crypto library (vs. builtin) for random functions" >&5

+$as_echo_n "checking for using the crypto library (vs. builtin) for random functions... " >&6; }

+# Check whether --enable-crypto-rand was given.

+if test "${enable_crypto_rand+set}" = set; then :

+  enableval=$enable_crypto_rand; want_crypto_rand="$enableval"

+else

+  want_crypto_rand="auto"

+fi

+

+if test "$want_crypto_rand" = "auto"

+then

+	case "$CRYPTOLIB" in

+	"")

+		want_crypto_rand="no"

+		;;

+	pkcs11)

+		want_crypto_rand="yes"

+		;;

+	openssl)

+		saved_cflags="$CFLAGS"

+		saved_libs="$LIBS"

+		CFLAGS="$CFLAGS $DST_OPENSSL_INC"

+		LIBS="$LIBS $DST_OPENSSL_LIBS"

+		if test "$cross_compiling" = yes; then :

+  want_crypto_rand="yes"

+else

+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext

+/* end confdefs.h.  */

+

+#include <openssl/rand.h>

+

+unsigned char buf[128];

+

+int main()

+{

+	if (RAND_bytes(buf, 128) != 1)

+		return (1);

+	return (0);

+}

+

+_ACEOF

+if ac_fn_c_try_run "$LINENO"; then :

+  want_crypto_rand="yes"

+else

+  want_crypto_rand="no"

+fi

+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \

+  conftest.$ac_objext conftest.beam conftest.$ac_ext

+fi

+

+		CFLAGS="$saved_cflags"

+		LIBS="$saved_libs"

+		;;

+	*)

+		as_fn_error $? "Unknown crypto library define $CRYPTOLIB" "$LINENO" 5

+		;;

+	esac

+fi

+case $want_crypto_rand in

+	yes)

+		if test "$CRYPTOLIB" = ""

+		then

+			as_fn_error $? "No crypto library for random functions" "$LINENO" 5

+		fi

+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$CRYPTOLIB\"" >&5

+$as_echo "\"$CRYPTOLIB\"" >&6; }

+		ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""

+		;;

+	no)

+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5

+$as_echo "no" >&6; }

+		ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"

+		;;

+esac